> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy on Kubernetes

> Deploy the DMG Collector as a DaemonSet, including RBAC, runtime config, host mounts, install, upgrade, and uninstall.

## Cluster resources

The DMG Collector is deployed as a single DaemonSet, with one pod per node. The manifest also creates the minimal RBAC resources required for operation.

| Object | Name | Purpose |
| :- | :- | :- |
| ServiceAccount | `dag-agent` | Identity for the DaemonSet pods |
| ClusterRole | `dag-agent-node-reader` | Get nodes to resolve node metadata |
| ClusterRoleBinding | n/a | Binds the SA to the ClusterRole |
| DaemonSet | `dag-agent` | Runs one collector pod per node |

The DaemonSet does not create a Service or Ingress; the agent has no listening ports. The only network path is outbound HTTPS from each pod to `DAG_SHIP_URL`.

## Runtime configuration

The DaemonSet is configured with the following:

* **`privileged: true`**: Required for `bpf(2)` and perf ring buffer access. Without it the kernel will refuse to load the programs.
* **`hostPID: true`**: Ensures `pid` fields in events map to real host PIDs rather than container-scoped ones. Without this the dashboard cannot correlate events from the agent with processes your operators actually see with `ps`, `crictl`, or `kubectl exec`.
* **`hostNetwork: true`**: Allows network observation in the host namespace.
* **`dnsPolicy: ClusterFirstWithHostNet`**: Ensures proper DNS resolution (e.g., private Route 53 via VPC).

## Host mounts

The collector uses three **read-only** host mounts. No writable host mounts are used.

| Mount | Purpose |
| :- | :- |
| `/sys/kernel/debug` | Access to tracefs for attaching tracepoints. |
| `/sys/kernel/btf` | BTF data for CO-RE relocation. |
| `/etc/machine-id` | Stable node identifier fallback. |

## Installation

The manifest uses seven placeholders that you substitute at apply time. The Kubernetes manifest is included in each release under `k8s/daemonset.yaml`.

**1. Extract the release tarball**

```bash theme={null}
tar xzf dag-agent-v<X>-linux-aarch64.tar.gz
cd dag-agent-v<X>-linux-aarch64/k8s
```

**2. Substitute placeholders and apply**

```bash theme={null}
sed -e 's|__REGISTRY__|<your-account>.dkr.ecr.<region>.amazonaws.com|' \
    -e 's|__TAG__|v1.8.0|' \
    -e 's|__SHIP_URL__|https://<name>-ingest.hilt.ai/ingest|' \
    -e 's|__CPU_REQUEST__|100m|' -e 's|__MEMORY_REQUEST__|128Mi|' \
    -e 's|__CPU_LIMIT__|500m|' -e 's|__MEMORY_LIMIT__|512Mi|' \
    daemonset.yaml | kubectl apply -f -
```

**3. Verify deployment**

```bash theme={null}
kubectl get daemonset dag-agent -o wide
kubectl get pods -l app=dag-agent -o wide
kubectl logs -l app=dag-agent --tail=20
```

## Tolerations and node selection

The shipped manifest tolerates the standard `CriticalAddonsOnly` taint. If your cluster uses dedicated node pools, tainted system pools, or GPU / special-hardware taints, add matching tolerations to the DaemonSet spec before applying. The agent is lightweight enough to run on every node in the cluster, including control-plane nodes and dedicated pools. Leaving a taint un-tolerated creates a visibility gap that the detection pipeline cannot fill.

If you want to exclude specific nodes, add a `nodeAffinity`. Ensure exclusions are documented, as they create explicit blind spots.

## Upgrade

Hilt pushes new images as both `v1.<new>.<patch>` and, in continuous deployments, a moving tag (`dev-latest`, `prod-latest`, etc., depending on your channel).

**Upgrade with immutable tag:**

```bash theme={null}
kubectl set image daemonset/dag-agent agent=<registry>/dag-agent:v1.9.0
kubectl rollout status daemonset/dag-agent
```

**Upgrade with moving tag:**

```bash theme={null}
kubectl rollout restart daemonset/dag-agent
kubectl rollout status daemonset/dag-agent
```

DaemonSet rolling updates replace one pod per node at a time; event stream interruption per node is on the order of 1–2 seconds.

## Uninstall

```bash theme={null}
kubectl delete -f daemonset.yaml
```

No node reboots are required, and no host artifacts remain.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.